secret-guard: DeepSeek Harness Security Plugin

secret-guard is a security plugin for DeepSeek Harness (DSH) designed to intercept and mask read/write access to sensitive files (e.g., .env), preventing API key leakage. It adopts a zero-build mode, with core capabilities including intercepting sensitive files before tool execution, applying content masking to results, providing `sg_*` tools that return metadata only, recording audit logs, and supporting hot reloading of rules. Installation is straightforward, requiring dsh ≥ 0.1.0-rc.6 and Node.js ≥ 22.19, and supports local development and debugging.